Sign-up

ID

VAR-201909-0108


CVE

CVE-2019-5065


TITLE

Blynk-Library Vulnerable to information disclosure

Trust: 0.8

sources: JVNDB: JVNDB-2019-008970

DESCRIPTION

An exploitable information disclosure vulnerability exists in the packet-parsing functionality of Blynk-Library v0.6.1. A specially crafted packet can cause an unterminated strncpy, resulting in information disclosure. An attacker can send a packet to trigger this vulnerability. This vulnerability stems from configuration and other errors in the operation of the network system or product. An unauthorized attacker can use the vulnerability to obtain sensitive information about the affected components. Blynk is a set of Internet of Things platform of Blynk in the United States. Blynk-Library is a Blynk library for embedded hardware. The vulnerability stems from the fact that when the network system or product performs operations on the memory, the data boundary is not correctly verified, resulting in incorrect read and write operations to other associated memory locations. Attackers can use this vulnerability to cause buffer overflow or heap overflow

Trust: 2.7

sources: NVD: CVE-2019-5065 // JVNDB: JVNDB-2019-008970 // CNVD: CNVD-2019-44986 // CNNVD: CNNVD-201909-203

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2019-44986

AFFECTED PRODUCTS

vendor:blynkmodel:blynk-libraryscope:eqversion:0.6.1

Trust: 1.8

vendor:blynkmodel:blynk-libraryscope:eqversion:v0.6.1

Trust: 0.6

sources: CNVD: CNVD-2019-44986 // JVNDB: JVNDB-2019-008970 // NVD: CVE-2019-5065

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-5065
value: MEDIUM

Trust: 1.0

talos-cna@cisco.com: CVE-2019-5065
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-5065
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2019-44986
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201909-203
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2019-5065
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2019-44986
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

talos-cna@cisco.com: CVE-2019-5065
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2019-5065
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2019-44986 // JVNDB: JVNDB-2019-008970 // CNNVD: CNNVD-201909-203 // NVD: CVE-2019-5065 // NVD: CVE-2019-5065

PROBLEMTYPE DATA

problemtype:CWE-125

Trust: 1.0

problemtype:CWE-200

Trust: 0.8

sources: JVNDB: JVNDB-2019-008970 // NVD: CVE-2019-5065

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201909-203

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201909-203

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-008970

PATCH
title:Top Pageurl:https://blynk.io/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2019-008970

EXTERNAL IDS
db:TALOSid:TALOS-2019-0854
Trust: 3.0
db:NVDid:CVE-2019-5065
Trust: 3.0
db:JVNDBid:JVNDB-2019-008970
Trust: 0.8
db:CNVDid:CNVD-2019-44986
Trust: 0.6
db:CNNVDid:CNNVD-201909-203
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2019-44986 // 
            
            
            
            JVNDB: JVNDB-2019-008970 // 
            
            
            
            CNNVD: CNNVD-201909-203 // 
            
            
            
            NVD: CVE-2019-5065

REFERENCES
url:https://talosintelligence.com/vulnerability_reports/talos-2019-0854
Trust: 2.4
url:https://nvd.nist.gov/vuln/detail/cve-2019-5065
Trust: 1.4
url:https://www.talosintelligence.com/vulnerability_reports/talos-2019-0854
Trust: 1.2
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-5065
Trust: 0.8
sources:
            
            
            CNVD: CNVD-2019-44986 // 
            
            
            
            JVNDB: JVNDB-2019-008970 // 
            
            
            
            CNNVD: CNNVD-201909-203 // 
            
            
            
            NVD: CVE-2019-5065

SOURCES
db:CNVDid:CNVD-2019-44986
db:JVNDBid:JVNDB-2019-008970
db:CNNVDid:CNNVD-201909-203
db:NVDid:CVE-2019-5065

LAST UPDATE DATE
2024-11-23T22:51:40.290000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2019-44986date:2019-12-12T00:00:00
db:JVNDBid:JVNDB-2019-008970date:2019-09-10T00:00:00
db:CNNVDid:CNNVD-201909-203date:2020-10-28T00:00:00
db:NVDid:CVE-2019-5065date:2024-11-21T04:44:16.903

SOURCES RELEASE DATE
db:CNVDid:CNVD-2019-44986date:2019-12-12T00:00:00
db:JVNDBid:JVNDB-2019-008970date:2019-09-10T00:00:00
db:CNNVDid:CNNVD-201909-203date:2019-09-04T00:00:00
db:NVDid:CVE-2019-5065date:2019-09-05T17:15:12.467